Claude the CFO — Privacy Policy

Effective date: April 29, 2026
Publisher: Brehan Crawford (Chorus / Crawford Wellness)
Contact: brehan@chorusforlife.com

1. Scope and audience

Claude the CFO ("the Software") is a private, internal tool operated by the Publisher for the Publisher's own businesses (Chorus and Crawford Wellness). It is not offered to the public and is not used to collect data from anyone other than the Publisher and the Publisher's authorized agents (e.g., bookkeeper, contractor).

2. What data the Software accesses

The Software, with the Publisher's explicit authorization, reads the following data from systems the Publisher already operates:

• QuickBooks Online: chart of accounts, journal entries, customer/vendor names, invoices, bills, payments, balances.
• Shopify (Crawford Wellness only): orders, payouts, transaction fees.
• PayPal: transactions, fees, currency conversions.
• Stripe (if configured): charges, payouts, subscription events.
• Bank and credit-card CSV exports uploaded manually by the Publisher.

The Software does not collect personal data from anyone other than the Publisher and the Publisher's authorized agents. Customer/vendor information accessed through the Publisher's accounting systems is processed only as part of the Publisher's own business records.

3. How the data is used

The Software uses this data exclusively to:

• Display financial dashboards (cash position, P&L, cash flow projections, recurring spend);
• Reconcile transactions across sources (e.g., a Shopify order paid via PayPal that lands in the Publisher's bank account);
• Produce AI-assisted analyses, summaries, and answers to questions the Publisher asks the Software's chat interface.

Data is not used for advertising, profiling, training third-party machine-learning models, or any purpose other than the above.

4. Where the data is stored

The Software runs on infrastructure controlled by the Publisher: by default, the Publisher's own computer; optionally, a small private server operated by the Publisher in the future. OAuth tokens and other credentials are encrypted at rest using a key derived from a passphrase that exists only on the Publisher's machine.

Data is not stored on Anthropic's, Intuit's, or any third party's servers beyond what is necessary to make a single API call (see section 5).

5. Third-party processors

The Software transmits data to the following third parties only as strictly necessary:

• Intuit, Shopify, PayPal, Stripe: read-only API calls to retrieve the Publisher's own data.
• Anthropic (Claude API): when the Publisher uses the chat feature, relevant transaction summaries are sent to Anthropic to generate a response. Anthropic processes this data per its own privacy policy and does not retain it for training when accessed via the API.

Each third-party processor has its own privacy policy, which the Publisher has reviewed and accepted.

6. Data retention and deletion

Data is retained on the Publisher's infrastructure indefinitely, at the Publisher's discretion. The Publisher may delete all data at any time by removing the Software's database.

7. Security

• OAuth tokens and API keys are encrypted at rest using AES-128-GCM (via Fernet) with a key derived via Argon2id from a passphrase known only to the Publisher.
• All API calls to third parties use HTTPS.
• The Software runs on the Publisher's local network and is not exposed to the public internet by default.

8. Rights of authorized users

Authorized users may, at any time:

• Request a copy of any data the Software has accessed about them or their work;
• Request deletion of any such data;
• Revoke their authorization to use the Software.

Requests should be sent to brehan@chorusforlife.com.

9. Changes to this policy

The Publisher may revise this policy. Material changes will be communicated to authorized users.

10. Contact

brehan@chorusforlife.com